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Amendments to the Specification 

Please replace the first complete paragraph on page 7 of the originally 
filed specification starting at line 2 and ending at line 6 with the following 
amended paragraph: 

If the number of timed out connections does not exceed the second 
predetermined threshold Bas, the result in step 309 is NO. and the process 
continues to step 31 1 where a complete packet diversion that was instituted in 
step 305 is reset. At this point, the switch 131 is directed to again divert only a 
predetermined small fraction of the SYN packets destined to server S, to web 
guard processor 201 (same as in step 301). The process then returns to step 
303^ 



Please replace the first paragraph of page 4 of the originally filed 
specification starting at line 3 and ending at line 22 with the following amended 
paragraph: 

In order to put the present invention in the appropriate context, it will be 
helpful to first review the infrastructure elements presently in use by context 
delivery companies and Internet Service Providers (ISPs) to provide fast and 
reliable delivery of information to users over the Internet. Referring to Fig. 1. a 
group of users or clients 101-104 are shown at workstations or home computers 
that are connected to various elements in the Internet 100. Internet 100 includes 
a plurality of interconnected routers 150-154, and layer 4-7 switches 130-132. 
The arrangement and capabilities of these elements is well known to those 
skilled in the art. Examples of level 4 switches are switches in the IPWorX™ 
WebDirector family available from Lucent Technologies. Examples of layer 7 
switches are the switches in the AppSwitch™ 3500 family available from Top 
Layer Networks. In Fig. 1, client 104 is shown as being connected to Internet 100 
via a router 140 within an Intranet 44Q 141 . This arrangement is meant simply to 
illustrate that the Internet is not a unitary arrangement but consists of many 
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interconnected individual networks of elements, some of which are referred to as 
Intranets or private networks. Likewise, in Fig. 1, a server 120 within an Intranet 
122 is shown as being connected to Internet 100 via a firewall 121. Here again, 
this depiction is illustrative of the fact that content is contained on servers like 
server 120 within the networks (Intranet 122) of content providers, and that some 
protection is currently afforded by software arrangements such as firewall 121 
which try to block unauthorized access. Server 120 can be the victim of a 
coordinated denial of service attack that the present invention is designed to 
prevent. 



Amendments to the Abstract 

Please replace the Abstract with the following amended! Abstract on the following 
page: 
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